Free Salesforce Slack Developer practice questions

Question 1

A contractor who was a collaborator on Ursa Major Solar's Slack CLI app has finished the engagement, and the app owner runs slack collaborator remove to take away their access. What else should the app owner do to keep the app secure?
A. Nothing else, because removing the collaborator immediately revokes every token the contractor used
B. Rotate the app's secrets and tokens, because a removed collaborator may still hold OAuth or app-level tokens
C. Delete the shared apps.json file from version control so the contractor can no longer deploy the app
D. Uninstall and reinstall the app in the workspace so that all existing users have to authorize it again

Accepted Answer

Correct answer: B. Rotate the app's secrets and tokens, because a removed collaborator may still hold OAuth or app-level tokens
Slack's collaboration guide warns that a removed collaborator may still retain OAuth (user and bot) or app-level tokens, so the app owner should rotate secrets and tokens after removing a collaborator. Removal alone does not invalidate tokens already obtained. Deleting apps.json from version control breaks collaboration for the remaining team and does not revoke anything. Reinstalling the app disrupts users and still leaves any copied app-level tokens and secrets unchanged.

Question 2

A Northern Trail Outfitters permit modal has an input block with block_id start_date that holds a datepicker with action_id start_date_value. When a ranger submits a date in the past, the app must keep the modal open and show a message under that field. Which acknowledgment should the Bolt app.view listener send?
A. await ack({ response_action: 'errors', errors: { start_date_value: 'Choose a future date' } })
B. await ack({ response_action: 'update', errors: 'Choose a future date for this permit' })
C. await ack(); await client.chat.postEphemeral({ text: 'Choose a future date' })
D. await ack({ response_action: 'errors', errors: { start_date: 'Choose a future date' } })

Accepted Answer

Correct answer: D. await ack({ response_action: 'errors', errors: { start_date: 'Choose a future date' } })
To show a validation message, the app responds to view_submission with response_action: 'errors' and an errors object keyed by the block_id of the input block, here start_date. Keying the error by the element's action_id does not match how Slack places errors, which is by block_id. response_action: 'update' replaces the view with a new one and does not take an errors string. A plain ack() closes the submitted view, so the ranger loses the modal, and an ephemeral message would not appear under the field.

Question 3

Cumulus Financial's Flag for compliance message shortcut opens a modal and then posts a confirmation in the conversation. When users run it on a reply inside a thread, the confirmation never appears in that thread. What explains this?
A. Message shortcuts cannot be used on threaded replies, so users must run them on the thread's parent message.
B. Apps cannot post back into the thread a shortcut was started from; they can post to the parent conversation.
C. The response_url expires as soon as a modal is opened from a shortcut, so nothing can be posted afterwards.
D. Threaded replies have no ts value, so the app must ask the user to paste the thread's link into the modal.

Accepted Answer

Correct answer: B. Apps cannot post back into the thread a shortcut was started from; they can post to the parent conversation.
Slack documents a current limitation: an app responding to a shortcut started from a threaded message cannot publish a message back to that thread, although it can publish to the parent conversation. The shortcut itself does run on threaded replies, which is why the modal opens. A response_url stays usable for up to five responses within 30 minutes, regardless of whether a modal is opened. Every message, including a threaded reply, has its own ts value.

Question 4

Universal Containers built a Bolt app with a custom step that creates purchase orders, and a workflow using that step runs in a Slack Connect channel shared with a supplier. Universal Containers employees can run the workflow, but supplier employees cannot and see a home_team_only warning. What explains this?
A. The supplier's workspace is on a Free plan, and custom steps only run for members of workspaces on paid plans.
B. The app was not distributed publicly, so it must be listed in the Slack Marketplace before external members can run it.
C. The step's input parameters use slack#/types/user_id, which can only resolve users from the workflow owner's team.
D. External members of a Slack Connect channel cannot use workflows containing steps built by your organization.

Accepted Answer

Correct answer: D. External members of a Slack Connect channel cannot use workflows containing steps built by your organization.
Slack's workflow steps guide states that, to protect the organization, external users connected through Slack Connect cannot use a workflow that contains connector steps or workflow steps built by your organization, and that this can show up as a home_team_only warning. The supplier's own plan does not explain the block, since the restriction applies to every external member. Apps that contain workflow steps cannot be distributed publicly or listed in the Slack Marketplace at all, so listing is not a fix. Typed input parameters such as user IDs are not the cause of this warning.

Question 5

Northern Trail Outfitters' /checkout command records who checked out each piece of gear. The app saved the user_name and channel_name fields from each slash command payload, and its records broke after several employees changed their display names. What should the developer do?
A. Save the token field with each record, because it uniquely identifies the user who ran the command.
B. Store user_id and channel_id instead, because names can change while the IDs stay the same.
C. Turn on Escape channels, users, and links, which keeps user_name values stable after a rename.
D. Look up each user_name with users.list on every request so the records follow any later rename.

Accepted Answer

Correct answer: B. Store user_id and channel_id instead, because names can change while the IDs stay the same.
Slack's slash command reference marks user_name as deprecated and says to use user_id, and it advises relying on IDs for workspaces, channels and users because the accompanying names can change arbitrarily. The token field is a deprecated verification token for the app, not an identifier for the user. The escaping setting only changes how mentions and links appear in the text parameter. Resolving names on every request adds API calls and still breaks records that were keyed by an old name.

Question 6

Cumulus Financial migrated an old classic app to a new Slack app with granular bot scopes. Code copied from the old app still calls chat.postMessage with as_user: true so that messages appear to come from the installing user. What should the app developer do?
A. Keep as_user, because it is a current argument that posts with the identity of whichever user installed the app
B. Remove the legacy as_user argument and post as the bot, using a user token only when acting for a person
C. Keep as_user and add the chat:write.customize scope, which re-enables as_user posting for apps that use granular bot scopes
D. Replace as_user with an app-level xapp- token, which posts messages on behalf of the user who installed the app

Accepted Answer

Correct answer: B. Remove the legacy as_user argument and post as the bot, using a user token only when acting for a person
chat.postMessage documents as_user as a legacy argument that only classic apps can use; a granular app posts as its bot with the bot token, and when it truly needs to act as a person it uses that person's user token with chat:write. It is not a current argument for new apps. chat:write.customize lets an app change the username and icon of its messages, and only with the user's permission; it does not re-enable as_user, which stays limited to classic apps. App-level tokens are for app-wide APIs such as apps.connections.open and cannot post messages for users.

Question 7

Bloomington Caregivers' app subscribes to message events in a very busy workspace. One afternoon its Request URL starts receiving events with the type app_rate_limited, each containing team_id and minute_rate_limited fields. What does this mean?
A. The app's Web API calls for that workspace have exceeded their tier, and all methods are blocked for one minute
B. The workspace generated over 30,000 events for the app within 60 minutes, so deliveries are rate limited
C. The app failed to answer more than 95% of deliveries within 60 minutes, and its subscriptions have been disabled
D. Slack has permanently disabled the app's event subscriptions until the app owner removes some event types

Accepted Answer

Correct answer: B. The workspace generated over 30,000 events for the app within 60 minutes, so deliveries are rate limited
Events API deliveries max out at 30,000 per workspace per app per 60 minutes; when a workspace exceeds that, Slack sends app_rate_limited events, one for each minute the app is limited, naming the team and the minute it started. Web API limits are signaled with HTTP 429 responses and Retry-After, not with an event. Failing more than 95% of deliveries leads to temporary disabling and an email to the app owner, not app_rate_limited events. The limit is not permanent and does not require removing subscriptions.

Question 8

Cumulus Financial's app posts a daily market summary in a German-speaking public channel. One channel member's Slack display language is French, and the app also sends that member private ephemeral tips. How should the developer choose the language for each piece of content?
A. Use the channel's locale from conversations.info for the summary and the user's locale from users.info for the tips
B. Use the installing admin's locale for all content so that every message and tip the app sends uses one consistent language
C. Use the French member's locale for the channel summary as well, because their preference is the most specific
D. Detect the language of the last few messages in the channel and reuse it for both the summary and the private tips

Accepted Answer

Correct answer: A. Use the channel's locale from conversations.info for the summary and the user's locale from users.info for the tips
Slack's localization guidance says to use the channel's locale for content published to the channel and, optionally, an individual user's locale for content only that user sees. In its example a French-speaking user in a German channel gets French in private interactions and German in the channel. The locale is retrieved with conversations.info or users.info and include_locale set to true. The installer's locale ignores both the channel and the user, and switching a shared summary to one member's language serves only that member. Guessing from recent messages is unreliable when Slack exposes locale fields directly.

Question 9

AW Computing is building a modal that collects a hardware request: device type, cost center and justification. Which two practices does Slack recommend for the modal's input fields? Choose 2 answers.
A. Wrap each input element in an input block and give every input a clear label
B. Place the inputs in an actions block so that each choice is submitted as soon as it is made
C. Use descriptive placeholder text for the select menus, such as "Choose a device type"
D. Use emoji such as a laptop icon in place of the input labels so the form looks less dense
E. Put each select menu in a section block's accessory slot so labels and inputs share one line

Accepted Answer

Correct answer: A. Wrap each input element in an input block and give every input a clear label | C. Use descriptive placeholder text for the select menus, such as "Choose a device type"
Slack's Block Kit accessibility guidance says to wrap inputs in input blocks, provide associated labels for all input fields, and use descriptive placeholder text for selects. The same guidance says not to wrap inputs in section or actions blocks, which rules out both the actions block layout and the section accessory layout for form fields. Emoji should not be used in input labels because screen readers announce only the emoji alias.

Question 10

Northern Trail Outfitters' onboarding app receives an employee's email address from the HR system and must find that person's Slack user ID with users.lookupByEmail. Which two bot scopes should the developer request? Choose 2 answers.
A. users:read
B. identify
C. users:write
D. team:read
E. users:read.email

Accepted Answer

Correct answer: A. users:read | E. users:read.email
users.lookupByEmail requires users:read.email, and Slack states that users:read.email must be requested at the same time as users:read. identify is an older scope tied to user identity in classic flows and does not unlock email lookups. users:write sets the app's presence and does not read profile data. team:read returns workspace information, not member emails.

Question 11

An app developer at Get Cloudy Consulting copied a Bolt for JavaScript OAuth sample that uses installationStore: new FileInstallationStore(). The app is about to go to production on several auto-scaled servers. What should the app developer do with the installation store?
A. Keep FileInstallationStore, because Bolt encrypts the files it writes and synchronises them automatically between all running app servers.
B. Remove the installation store and rely on Bolt's in-memory default, since tokens are re-issued by Slack on every incoming event.
C. Implement a custom store with storeInstallation, fetchInstallation and deleteInstallation backed by a secure, persistent database.
D. Copy each new bot token into the SLACK_BOT_TOKEN environment variable on every server when an installation completes successfully.

Accepted Answer

Correct answer: C. Implement a custom store with storeInstallation, fetchInstallation and deleteInstallation backed by a secure, persistent database.
Bolt's documentation provides FileInstallationStore for development and testing only and says production apps should implement their own installation store, with handlers that store, fetch and delete installations in persistent storage. The file store does not synchronise files across servers. Slack does not re-issue tokens on each event, so a store is required to look tokens up for incoming events. A single environment variable cannot hold one token per installation for a distributed app.

Question 12

A security reviewer at Cumulus Financial worries that an attacker who captures one validly signed Events API request could resend it hours later and have the app process it again. The app already verifies X-Slack-Signature. What should the app developer add?
A. Reject any request whose X-Slack-Request-Timestamp differs from the server's current time by more than five minutes, before trusting the signature.
B. Turn on token rotation so the bot token expires every 12 hours and any captured request becomes invalid once its token has been rotated.
C. Regenerate the signing secret from Basic Information every day so that signatures on older captured requests no longer match the new secret.
D. Ask Slack to include the verification token in each payload and require both the token and the signature to match before processing.

Accepted Answer

Correct answer: A. Reject any request whose X-Slack-Request-Timestamp differs from the server's current time by more than five minutes, before trusting the signature.
The timestamp is part of the signed basestring, so an attacker cannot change it without breaking the signature, and Slack's guidance is to ignore requests whose timestamp is more than five minutes from local time to protect against replay attacks. Token rotation limits the life of the app's outbound access tokens; it has nothing to do with inbound request signatures. Regenerating the signing secret daily is disruptive and still leaves a full day for replay. The verification token is a static deprecated value that is identical on every request, so it adds no replay protection.

Question 13

An org-ready Bolt app at Northern Trail Outfitters has been installed at the organization level and added to three workspaces. A scheduled job runs this code with the org-wide bot token, and the bot token has the channels:read scope:

const result = await client.conversations.list({
    types: 'public_channel',
    limit: 200
});

The call returns an error instead of a channel list. Which change fixes the error?
A. Replace the bot token with the installing Org Admin's user token, because only user tokens can list channels
B. Add the groups:read scope as well, because org tokens must be able to read every channel type to list any
C. Pass team_id with the ID of the workspace whose channels should be listed in the conversations.list call
D. Call auth.teams.list first, because the token stays inactive until the app reads its list of workspaces

Accepted Answer

Correct answer: C. Pass team_id with the ID of the workspace whose channels should be listed in the conversations.list call
An org-ready app's token can represent installations in many workspaces, so methods such as conversations.list, users.list and users.conversations require a team_id argument naming the workspace to act on; passing it is safe even for single-workspace installs, where it is ignored. Switching to a user token does not answer the question of which workspace to list. The groups:read scope only matters for private channels and is not a prerequisite for listing public ones. auth.teams.list reports which workspaces the app can access, but calling it does not activate the token or remove the need for team_id.

Question 14

Get Cloudy Consulting's onboarding app creates a project channel for each new client and invites the client's two contacts, who must also be able to invite colleagues from their own organization. The app's bot token has conversations.connect:write. Refer to the request body below:

{
    "channel": "C0PROJ1234",
    "emails": ["lead@client.example", "pm@client.example"]
}

Which two changes should the developer make to the conversations.inviteShared calls? Choose 2 answers.
A. Send one call per contact, because each call may invite only one email address or one user ID
B. Set external_limited to false, because invitations default to letting recipients only send messages
C. Add the admin.conversations:write scope, because only admin scopes can turn a channel into a Slack Connect channel
D. Replace emails with user_ids for both contacts, because email invitations cannot add people from another organization
E. Call conversations.acceptSharedInvite from the same app first, because invitations must be pre-accepted by the sender

Accepted Answer

Correct answer: A. Send one call per contact, because each call may invite only one email address or one user ID | B. Set external_limited to false, because invitations default to letting recipients only send messages
The emails and user_ids arguments accept arrays, but only one email or one user ID may be invited per call, so the app must loop over the contacts. The external_limited argument defaults to true, which lets recipients only send messages and not invite others, so it must be set to false for the contacts to invite colleagues. conversations.connect:write is the scope this method needs, and inviting an external user turns the channel into a Slack Connect channel without admin scopes. Email invitations do reach people in another organization: Slack emails the recipient a URL that joins the Slack Connect channel, so switching to user IDs is not needed. Acceptance happens on the recipient's side, not by the sender.

Question 15

Bloomington Caregivers already runs a Bolt for Python app in production that handles shift-swap requests. The developer now needs to add a custom step that Workflow Builder users can drop into their workflows, and wants an official, step-by-step starting point rather than designing the pattern from scratch. Which resource should the developer use?
A. The Deno Blank Template, after migrating the whole production app to the Deno Slack SDK so that it can expose custom steps
B. The Custom Step for Workflow Builder: Existing Bolt app tutorial for Bolt for Python in Slack's Samples & tutorials catalog
C. A Steps from Apps tutorial that listens for the workflow_step_edit event and saves the configuration with workflows.updateStep
D. A Block Kit Builder template for workflow forms, pasted into the app's Home tab so users can add the step to their workflows

Accepted Answer

Correct answer: B. The Custom Step for Workflow Builder: Existing Bolt app tutorial for Bolt for Python in Slack's Samples & tutorials catalog
Slack's Samples & tutorials catalog includes a Custom Step for Workflow Builder: Existing Bolt app tutorial for Bolt for Python (and for JavaScript), which shows how to add a custom step to an app that already exists and wire it into Workflow Builder. Migrating to the Deno Slack SDK is unnecessary because Bolt apps support custom steps directly. Steps from Apps, with its workflow_step_edit event, was the legacy model and was retired in favour of custom steps. A Block Kit layout on the Home tab does not register a workflow step.

Question 16

A confidential pricing file was leaked from Bloomington Caregivers' Enterprise Grid organization, and the security team knows its file ID, F0789XYZ. They want to see which members downloaded it. Which Audit Logs API request should the developer make?
A. Call /audit/v1/logs with action=file_downloaded and entity=F0789XYZ to return download events for that file
B. Call /audit/v1/logs with action=file_downloaded and actor=F0789XYZ, because the file is the source of each event
C. Call /audit/v1/actions with entity=F0789XYZ, because that endpoint lists every action recorded against an object
D. Call /audit/v1/schemas with the file ID so the response lists each member who has opened or downloaded the file

Accepted Answer

Correct answer: A. Call /audit/v1/logs with action=file_downloaded and entity=F0789XYZ to return download events for that file
Each audit event has an actor who takes an action on an entity, so a download is recorded as file_downloaded with the file as the entity and the member as the actor, and the entity filter narrows results to that file. The actor filter takes the user ID of whoever initiated the action, not a file ID. The /actions endpoint lists the kinds of actions the API returns, not events. The /schemas endpoint describes the object types the API returns.

Question 17

Northern Trail Outfitters' developer is preparing to install an app that calls admin.conversations.* and admin.teams.* methods across the company's Enterprise Grid organization. Which two requirements must the installation meet? Choose 2 answers.
A. The OAuth install is completed by an Org Admin or an Org Owner of the Enterprise organization
B. The installer selects the Enterprise organization, not a single workspace, on the install screen
C. A Workspace Admin installs the app on each workspace so that the admin scopes apply to that workspace
D. The admin scopes are added under Bot Token Scopes so the methods are called with an xoxb token
E. The Primary Org Owner alone can install it, because Org Admins cannot authorize any admin scope

Accepted Answer

Correct answer: A. The OAuth install is completed by an Org Admin or an Org Owner of the Enterprise organization | B. The installer selects the Enterprise organization, not a single workspace, on the install screen
Admin scopes are obtained through OAuth v2, but the app must be installed by an Admin or Owner of the Enterprise organization and installed on the entire org rather than a workspace. Per-workspace installs by Workspace Admins cannot grant admin scopes. Admin scopes are user token scopes, so methods such as admin.teams.list are called with a user token. Org Admins as well as Org Owners can install apps that request admin scopes.

Question 18

Ursa Major Solar's distributed solar-monitoring app is installed on four customer workspaces, and the team wants to submit it to the Slack Marketplace next week. What should the developer tell the team?
A. Slack first requires the app to run as an unlisted distributed app for 90 days before its listing can be submitted
B. The app must reach at least 1,000 weekly active users across all workspaces before the submission page unlocks
C. The app must pass a paid third-party penetration test, with the report attached, before it can be submitted for review
D. Submission is blocked until the app is installed on at least 10 active workspaces, meaning used in the past 28 days

Accepted Answer

Correct answer: D. Submission is blocked until the app is installed on at least 10 active workspaces, meaning used in the past 28 days
Before submitting, an app must be installed on 10 or more active workspaces, where an active workspace has been used in the past 28 days, and apps that do not meet this are blocked from submitting (security and compliance partners using the Discovery API are the exception). Slack sets no 90-day unlisted period. There is no 1,000 weekly active user threshold. A paid penetration test is not a submission requirement, although Slack may perform its own security review at any time.

Free Salesforce Slack Developer
Practice Questions

What is the Slack Developer exam like?

Questions by exam section

Apps in the Slack Platform

Question 1 · Harder

Design the Interactive Flow of Your App

Question 2 · Medium

Question 3 · Harder

Question 4 · Medium

Question 5 · Medium

Design Your Workflows: Spotlight on Slack's APIs

Question 6 · Medium

Question 7 · Harder

Design a Great User Experience

Question 8 · Medium

Question 9 · Medium · Choose 2

Design for Security

Question 10 · Medium · Choose 2

Question 11 · Medium

Question 12 · Medium

Design for Scale

Question 13 · Medium

Question 14 · Harder · Choose 2

Tools

Question 15 · Medium

APIs for Managing Your Slack

Question 16 · Medium

Question 17 · Medium · Choose 2

Distribute Your App

Question 18 · Easier

Where to go after these 18 questions

Get Slack Developer exam updates by email

Ready for a full Slack Developer practice exam?

Free Salesforce Slack DeveloperPractice Questions